What your employee AI use policy should allow — CHRO & People Compass

When it comes up

When employees start using AI tools on their own, after a data incident, when IT rolls out an enterprise assistant, or when your current policy is more than six months old.

Your options

Ban generative AI

Fits when: A short-term stop while you assess a serious incident and secure tools.

Watch out: Drives use out of sight (shadow AI); employees fall behind.

Approved tools with data rules

Fits when: You have at least one secure enterprise tool and can explain which data may go where.

Watch out: Requires training, a request route for new tools and regular updates.

Open use with guidance

Fits when: Low-sensitivity work only and strong existing data controls.

Watch out: Sensitive data can leak into tools with weak terms; inconsistent quality.

How to decide

Classify data (public, internal, confidential, personal/sensitive) and decide which tools each class may enter.
List approved tools and set a fast route to request new ones.
Set disclosure rules: when AI use must be disclosed to colleagues, customers or candidates.
Name banned uses: for example emotion recognition, covert monitoring, decisions about people without human review.
Name who to ask, require training by role, and review twice a year.
Generate the draft, FAQ and rollout plan with the AI policy kit, then have legal and security review it.

Trade-offs

A ban stops visible use but not real use; approved tools with rules balance safety and productivity but need ongoing effort; open use maximizes experimentation but risks data leaks.

Real examples

Samsung banned generative AI tools on company devices for staff at a major division in May 2023 after engineers uploaded sensitive data, including source code, to ChatGPT; it later said the ban was temporary. Source: Fortune — Samsung bans employee use of ChatGPT after data leak (May 2, 2023) ↗
Microsoft and LinkedIn's 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work, and only 39% of users had received AI training from their company. Source: Microsoft and LinkedIn — 2024 Work Trend Index on the state of AI at work (May 8, 2024) ↗

What to check first

Which AI tools employees already use, approved or not.
Your data classification and what each AI tool's contract says about training on your data.
Legal requirements where you operate (for example the EU ban on emotion recognition at work).
Who will own policy updates and employee questions.

Learn and use

Sources

Last reviewed 2026-10-01.